Events Manager reflects untrusted input into executable page output
An unauthenticated attacker can supply input that Events Manager through 7.4.2 reflects into page output without adequate neutralization. Script executes in the site’s origin when a victim encounters the crafted response; the CNA vector explicitly requires user interaction. The endpoint, parameter, output context and victim role are unspecified. The revised authoritative version data identifies 7.4.3 as unaffected.
- Component
- Events Manager
- Plugin slug
events-manager- Affected
- <= 7.4.2
- Safe version
7.4.3- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 46 known issues for this plugin.
Update, patch or deactivate.
Update Events Manager to 7.4.3 or later. Until updated, restrict the affected feature or disable the component. Validate allowed request values and apply context-specific output escaping at every reflected output sink. Merely authenticating the victim does not prevent reflected script execution.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L